Modified computer motherboard security and identification system

• US 6,463,537 B1
• Filed: 01/04/1999
• Issued: 10/08/2002
• Est. Priority Date: 01/04/1999
• Status: Expired due to Fees

• Current Assignee: Coder Technologies Incorporated
• Original Assignee: Coder Technologies Incorporated
• Inventors: Tello, Jose Alberto
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US09/223,821
• Time in Patent Office: 1,373 Days
• Field of Search: 713/182, 713/185, 713/168, 713/172, 380/277, 380/255
• US Class Current: 713/182
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/82 Protecting input, output or interconnection devices
• CPC Class Codes: G06F 2211/1097 Boot, Start, Initialise, Power
• CPC Class Codes: G06F 2221/2107 File encryption

Abstract

A ‘personalized’ computer with a unique encrypted digital signature which will not boot up or recognize any data storage or communication peripheral devices without a matching ‘personalized’ smart card containing a complementary encrypted digital signature. A modified BIOS (Basic Input Output System) replaces the standard BIOS of a motherboard and allows a security engine microprocessor to take over preboot control of the computer from the motherboard CPU (Central Processing Unit), configures and operates the encryption-based security system, and enables or disables selected data storage devices and other user selectable peripherals upon start up and shut down of the computer. This use of a modified BIOS also allows this invention to work with any operating system or computer microprocessor chipset. The enabling or disabling of peripheral devices involves the use of special enabling/disabling circuits and a procedure for checking the security engine for the presence of an encrypted list of allowed peripheral devices before any particular device driver will be operational. A modified DDL (Device Driver Layer), loaded in the hard drive of the computer as part of the resident O/S (Operating System) of the computer, and memory buffer circuits allows a real time encryption system to be in place for any communication or data storage device. A data encryption engine in the security engine microprocessor allows encryption and decryption of all data stored in data storage devices, including the smart card, and moved through communication devices such as a modem. Upon power up, reset or interrupt of the computer, the microprocessor looks for, and if present, reads from the smart card in the smart card reader which is logically connected to the security engine microprocessor. A software program compares a unique digital signature placed in the smart card to a digital signature assigned to the computer. If these two digital signatures are complementary, the boot up procedure is allowed to continue and access to the computer allowed up to a predetermined level depending on the level of access configured on the smart card. This invention can also be used to allow identification and authentication of the computer and its user in networks.

Claims

1. An identification and security system for a personal computer having an operating system, said identification and security system comprising:

a) a motherboard modified to include a security engine and enabling and disabling logic coupled to the security engine;

b) a basic input output system (BIOS) coupled to said motherboard, said BIOS modified to allow a microprocessor within the security engine to take over control of a microprocessor for the personal computer coupled to the motherboard;

c) a device driver layer (DDL) portion of said operating system modified to;

1. prevent loading of device drivers unless an authorization code is present in an internal memory of said security engine;

2. intercept all read and write operations to allow encryption and decryption of all data input to and output from said personal computer;

d) a smart card reader coupled to said security engine for reading a smart card, said smart card for providing said authorization code.

2. The identification and computer security system as claimed in claim 1, wherein said modified motherboard comprises a means for controlling all the security functions of said computer;

a means for enabling and disabling peripheral devices connected to said computer;

a means for encrypting and decrypting all data moving through the bus system.

3. The identification and computer security system as claimed in claim 2, wherein said means for controlling the security functions of said personal computer comprises a microprocessor based security engine embedded in said motherboard.

4. The identification and computer security system as claimed in claim 3 wherein the microprocessor based security engine comprises a microprocessor with internal memory;

external scratch memory; and

a programming circuit for programming the internal memory of said security engine microprocessor.

5. The identification and computer security system as claimed in claim 3, wherein said internal memory contains encryption algorithms comprising a first algorithm for calculating hash numbers, a second algorithm for calculating an encryption key to be used for communications between the security engine microprocessor and said smart card system, a third algorithm for encrypting all application data, a fourth algorithm for altering said data, a fifth algorithm for encrypting data which is to be passed between at least two computers, and a sixth algorithm for performing a check for errors in the communications between said security engine and said smart card reader.

6. The identification and computer security system as claimed in claim 2, wherein said means for enabling and disabling peripheral devices comprises a plurality of enabling and disabling circuits embedded in said motherboard and connecting said peripheral devices and the security engine microprocessor.

7. The identification and computer security system as claimed in claim 2, wherein said means for encrypting and decrypting all data moving through the computer bus system under the control of said security engine microprocessor comprises a circuit with a programmable device and memory buffer connected to the computer bus system and the security engine microprocessor, and a header in said memory buffer which contains all parameters for a cryptographic procedure to be performed.

8. The identification and computer security system as claimed in claim 1, wherein said modified DDL creates a header for all encryption procedures for application data, creates a header for requesting identification from at least two computers, and creates headers for the decryption of identification requests received from said at least two computers.

9. The identification and computer security system as claimed in claim 1, wherein said modified BIOS comprises a first function which puts the motherboard Central Processing Unit into an endless loop upon power on or interrupt of the computer and passes control to the security engine microprocessor until all security procedures are performed, a second function which checks for the presence of said smart card upon power on, reset, or interrupt of the computer, and a third function which displays a security configuration set up screen and inputs user inputted data to the security engine scratch memory.

10. The identification and computer security system as claimed in claim 1, wherein said smart card reader is connected to the microprocessor of the security engine and a plurality of smart cards which contain internal memory, wherein one of said plurality of smart cards is identified to be a vendor card, at least one of said plurality of smart cards identified to be a user card, and an equal number of repair cards as user cards.

11. The identification and computer security system as claimed in claim 10, in which an internal memory of said vendor smart card is divided into two sections, a Key Management Area and an Identification area, wherein a parameter which sets the maximum key length for all cryptographic procedures is stored in the Key Management area and said key length parameter is passed to the internal memory of the security engine microprocessor when the vendor card is inserted into the card reader.

12. The identification and computer security system as claimed in claim 10, in which an EEPROM of the repair smart card is divided into two sections—

a Key Management Area and a Restricted area wherein the Restricted area contains an index of files or directories that are to remain hidden when said repair smart card is inserted in the card reader of the computer system for which it was created.

13. The identification and computer security system as claimed in claim 10, wherein an internal memory of said user smart cards is comprised of ROM and EEPROM in which the EEPROM is divided into an Identification area for storing user identification data and a register of smart card identification codes;

an Application area for the storage of data or programs by the user or outside agents; and

a Key Management area for storing hash numbers, a communication key for communications between the security engine microprocessor and the smart card, and communication keys and identification codes for any applications which may be stored in the Application area and the ROM memory contains encryption algorithms comprising a first algorithm for calculating hash numbers, a second algorithm for calculating an encryption key to be used for communications between the security engine microprocessor and said smart card system, a third algorithm for encrypting all application data, a fourth algorithm for altering said data, a fifth algorithm for encrypting data which is to be passed between at least two computers, and a sixth algorithm for performing a check for errors in the communications between said security engine and said smart card reader;

a look up table of commands and software which controls the security functions of the smart card.

14. A method of controlling access to a computer system and the data contained thereof comprising:

a. embedding a security engine comprising a microprocessor, scratch memory and a programming circuit connected to the security engine microprocessor in the computer system motherboard;

b. storing an algorithm for generating hash numbers in the internal memory of said microprocessor;

c. embedding a plurality of enable/disable circuits, connected to the security engine microprocessor and all peripheral devices in said motherboard;

d. embedding in said motherboard a memory buffer circuit comprising a programmable device and memory means connecting said security engine microprocessor and the ISA Bus;

e. embedding in said motherboard a memory buffer circuit comprising a programmable device and memory means connecting said security engine microprocessor and the PCI Bus;

f. connecting to the security engine microprocessor a smart card system comprising a smart card reader and at least one smart card which has more than one internal memory with a first memory containing an algorithm for creating hash numbers and a second memory having space for storing inputted data and the hash numbers created by the algorithm in the first memory;

g. replacing the standard BIOS with a modified BIOS which contains software routines that allow for the set up of the security configuration of the computer system, the input of user identification data and for the security engine microprocessor to take control of the start up of the computer system;

h. replacing the standard device driver layer of the computer system with a modified device driver layer, in which the modifications comprise the prevention of the loading of device drivers unless an authorizing code is present in the internal memory of the security engine microprocessor, the interception of all read and write procedures to enable the encryption and decryption of all data, the creation of a header for all encryption and decryption procedures for application data and the creation of a header for remote identification of said computer over a network;

i. personalizing said computer system and matching smart card by storing more than one hash number generated from identification information inputted by the user into the internal memory of the security engine microprocessor and complementary hash numbers into the second memory of the smart card;

j. authenticating the identity of a user upon attempted access to said computer system;

k. controlling access to said computer and peripheral devices;

l. securing all data stored in or moving through said peripheral devices through the use of cryptographic algorithms.

15. The method according to claim 14, wherein said smart cards comprises a plurality of smart cards, wherein one of said plurality of smart cards is identified to be a vendor card, at least one of said plurality of smart cards identified to be a user card, and an equal number of repair cards as user cards and the internal memory of said vendor smart card memory comprises a Key Management Area and an Identification area, wherein a parameter which sets the maximum key length for all cryptographic procedures for said computer system is stored in the Key Management area and which said key length parameter is passed to the internal memory of the security engine microprocessor when the vendor card is inserted into the card reader of the system for the first time.

16. The method according to claim 14, wherein a setup routine for the personalization of said computer identification and security system comprises the steps of:

a. inputting a plurality of identification data to the scratch memory of the security engine;

b. writing this data to the second memory of the smart card;

c. generating more than one hash number from the inputted identification data using the algorithm stored in the internal memory of said security engine microprocessor with the maximum key length of said algorithm determined by the key length parameter passed from said vendor card and stored in the internal memory of said security engine microprocessor;

d. burning the hash numbers to the internal memory of the security engine microprocessor using the programming circuit;

e. generating more than one hash number in the smart card using the complementary algorithm stored in the first memory using the identification data written to the second memory of the smart card;

f. writing the hash numbers to the second memory of the smart card microprocessor.

17. The method according to claim 14, wherein the authentication procedure for said computer identification and security system comprises the steps of:

a. checking by the security engine microprocessor, upon power on, reset or interrupt, the smart card reader for a valid smart card;

b. synchronizing communications between the security engine microprocessor and the valid smart card inserted in said smart card reader;

c. reading by the security engine microprocessor more than one hash number from the internal memory of the security engine and the complementary hash numbers from the second memory of the smart card if a valid smart card is inserted into the reader;

d. placing said hash numbers in the scratch memory of the security engine;

e. checking for a match between the security engine hash numbers and the smart card hash numbers using an authentication algorithm;

f. if a match exists, reading by the BIOS the security configuration for the computer, enabling all allowed peripheral devices, setting up cryptographic procedures for selected peripheral devices and allowing the loading of the computer operating system;

g. if a match does not exist, terminating the start up procedure.

18. The method according to claim 17, wherein the synchronization of communications between the smart card and the security engine microprocessor further comprises the use of communication keys unique to each computer and matching smart card that is generated from the hash numbers stored in the internal memory of the security engine microprocessor and the internal memory of said matching smart card.

19. The method according to claim 14, wherein the securing all data stored in or moving through said peripheral devices comprises the steps of:

a. intercepting all read or write procedures in the device driver layer;

b. creating a header in the device driver which contains all the parameters required for a cryptographic procedure;

c. sending said header through the Bus system connected to the peripheral device which is involved in the read or write operation to the memory buffer circuit connected to said Bus system;

d. reading said header and the encryption parameters stored in the memory of the security engine by the security engine microprocessor;

e. reading of data to be encrypted or decrypted from the memory means of the memory buffer circuit by the security engine microprocessor;

f. encrypting or decrypting said data and sending the altered data back to the memory means of the memory buffer circuit;

g. sending said altered data to the appropriate peripheral device.

20. A method of uniquely personalizing a computer having a modified motherboard comprising a microprocessor based security engine, Flash memory in said microprocessor, scratch memory buffer in said security engine, an algorithm for generating hash numbers in the internal memory of said microprocessor and a programming circuit connected to the security engine microprocessor;

a modified BIOS which contains software routines that allow for the set up of the security configuration of the computer system, the input of user identification data and for the security engine microprocessor to take control of the start up of the computer system; and

a smart card system comprising a smart card reader connected to said security engine microprocessor and at least one smart card which has more than one internal memory with a first memory containing an algorithm for creating hash numbers which is a derivative of the algorithm in the security engine and a second memory having space for storing inputted data and the hash numbers created by the algorithm in the first memory;

comprising the steps of;

a. inputting a plurality of identification data to the scratch memory of the security engine;

b. copying this data to the second memory of the smart card;

c. generating more than one hash number from the inputted identification data in the security engine scratch memory using the algorithm stored in the internal memory of said security engine microprocessor;

d. transferring all data from the security engine microprocessor flash memory to the memory buffer;

e. burning the hash numbers and transferred data to the flash memory of the security engine microprocessor using the programming circuit;

f. generating more than one hash number in the smart card using the algorithm stored in the first memory using the identification data copied to the second memory of the smart card;

g. writing the hash numbers to the second memory of the smart card microprocessor.

21. The method according to claim 20, wherein upon the changing of said identification data said programming circuit is automatically updated by the writing of this data into the second memory of the smart card inserted into the card reader and the flash memory of the security engine.

22. The method according to claim 21, wherein the automatic updating of any changed identification data to the second memory of the smart card and the flash memory of the security engine microprocessor comprises the steps of:

a. writing the contents of the security engine flash memory to the scratch memory;

b. writing any changes made to the identification data to the identification look up table in the security engine scratch memory;

c. writing any changes made to the identification data to the Identification area of the smart card internal memory;

d. creating new hash numbers from the identification data by the smart card microprocessor;

e. generating a new communication key for the smart card from the hash numbers;

f. creating new hash numbers from the identification data by the security engine microprocessor;

g. generating a new communication key for the security engine from the hash numbers;

h. burning the contents of the scratch memory of the security engine to the flash memory.

23. A method for creating a hierarchy of subordinate computer systems in which the computer system used to create a subordinate system has access to said subordinate system, using more than one computer having a modified motherboard comprising a microprocessor based security engine, flash memory in said microprocessor, scratch memory connected to said security engine, an algorithm for generating hash numbers and an algorithm for generating a communication key in the internal memory of said microprocessor and a programming circuit connected to the security engine microprocessor;

a modified BIOS which contains software routines that allow for the set up of the security configuration of the computer system, the input of user identification data and for the security engine microprocessor to take control of the start up of the computer system;

a smart card system comprising a smart card reader connected to said security engine microprocessor and an equal number of smart cards as computers having more than one internal memory with a first memory containing an algorithm for creating hash numbers which is a derivative of the algorithm in the security engine and a second memory having space for storing inputted data, the hash numbers created by the algorithm in the first memory and a smart card identification code, of which one smart card is identified as ‘

used’

having at least two unique hash numbers in its second memory and a second smart card is ‘

new’

with no identification data or hash numbers in its internal memory; and

at least one of said computers which contains no identification data in its security engine memory;

comprising the steps of;

a. inserting said used smart card into the card reader of the computer which has no identification data in its security engine memory;

b. writing one of said smart card'"'"'s hash numbers to the scratch memory of the computer security engine;

c. creating a complement of said hash number;

d. creating a communication key from said hash number in the security engine;

e. writing said communication key to the security engine scratch memory;

f. inputting identification data to the scratch memory of the security engine;

g. inputting security configuration data to the scratch memory of the security engine;

h. creating two new hash numbers from the identification data in the scratch memory of the security engine;

i. writing the CK, two new hash numbers, and identification data and security configuration to the smart card inserted in the smart card reader;

j. ejecting the used smart card from the reader;

k. inserting a new smart card into the reader;

l. writing to said new smart card an identification code which identifies it as part of a subordinate system;

m. writing the hash number complement, identification data and security configuration to the new smart card;

n. calculating two new hash numbers, in the smart card, from the identification data;

o. creating a complement of the two hash numbers;

p. calculating a communication key from the complement of the hash number complement passed from the ‘

used’

smart card;

q. writing the complement of the new hash numbers and the complement of the hash number passed from the ‘

used’

smart card, and the communication key calculated by the new smart card to the internal memory of the new smart card;

r. writing all data in the security engine flash memory to the scratch memory;

s. burning the contents of the scratch memory to the security engine flash memory.

24. A method of identifying and authenticating, over a network, a uniquely personalized computer having a modified motherboard comprising a microprocessor based security engine, flash memory in said microprocessor, a look up table of personal identification data, a secret identification number which is the same for all computers containing this invention, in said flash memory;

scratch memory in said security engine;

an algorithm for generating hash numbers, a linear congruency function and a public key encryption algorithm in the internal memory of said microprocessor;

a modified DDL that allows for the creation of headers; and

a smart card system comprising a smart card reader connected to said security engine microprocessor and a personalized smart card which has internal memory with an Identification area for storing personal identification data and an Application area for storing external applications and an index for the location and identification codes for each application; and

a data base of personal identification data for other personalized computers comprising the steps of;

a. a first personalized computer requesting identification through an application from a second personalized computer over a network comprising selected identification data from the second computer'"'"'s identification data look up table and select information from the second computer'"'"'s smart card;

b. a device driver in the second computer generating a header comprised of the identification task, the addresses of the identification parameters requested and the two byte code for any smart card application from which data is required and the location of said data;

c. sending this header to the security engine microprocessor;

d. reading of the identification data from the look up table in said security engine microprocessor flash memory;

e. reading of the identification data from the look up table of the internal memory of the smart card inserted in the smart card reader;

f. writing the retrieved identification data to the internal memory of the security engine microprocessor;

g. generating a hash number from the identification data stored in said internal memory;

h. passing said hash number through a linear congruency function using the secret identification number stored in flash memory;

i. encrypting the resultant number with the public key algorithm;

j. sending the encrypted data to the first computer;

k. the receiving application of the first computer calling a device driver to decrypt the data;

l. the device driver creating a header comprising the parameters for the decryption procedure;

m. sending this header with the encrypted data to the internal memory of the first computer'"'"'s security engine microprocessor;

n. decrypting the data using the public key algorithm stored in the flash memory of the first computer;

o. passing the resultant data through the linear congruency function to produce the hash number generated by the second computer and the secret identification number;

p. decrypting the hash number using the hash number generating algorithm stored in the flash memory of the first computer;

q. comparing the identification data with that stored in the data base;

r. confirming the identity of the second computer if the data matches.